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We show that a secure quantum protocol for coin tossing 
exist. The existence of quantum coin tossing support the con- 
jecture of D.Mayers [Phys.Rev.Lett.78, 3414(1997)] that only 
asymmetrical tasks as quantum bit commitment are impossi- 
ble. 
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One of the most simple and interesting application of 
quantum mechanics is the quantum cryptography (QC) 
0- JÏ4| ]. Among QC, the most well known and exper- 
imcntally realized one is the quantum key distribution 
(QKD) [J- g. Besides QKD, there are quantum bit 
commitment (QBC) ]9|JÏ0[|, quantum oblivious transfer 
PJ, and quantum secure computation (QSC) [0|Ï3j. 
Recently, however, it has been shown that QBC is in- 
secure HJnJ. As noted in Ref. |{J, the insecurity of QBC 
implies the insecurity of other quantum cryptographical 
applications which are powerful enough to obtain the bit 
commitment. It was also noted in Ref. |J that there 
might exist secure protocols for coin tossing and multi- 
party computations, because it is not known how to build 
bit commitment on top of them. In this Report, we show 
that a secure quantum protocol for coin tossing exist in- 
deed. 

First, we present a quantum protocol for coin tossing. 

1) One party, Alice, prepares N ( N is an integer much 
greater than 1) pairs of the maximally entangled states. 
Next, Alice sends to another party, Bob, one side parti- 
des of the N pairs while storing the other partides of the 
N pairs. 

2) For each N partides Bob receives, he randomly per- 
forms spin-measurement along z or x axis. Next, he telis 
Alice only the measurement axes while keeping the out- 
come of the measurement. 

3) Alice performs spin-measurement on each N parti- 
des she is storing, according to the axes Bob has told. 

4) If Alice honestly sent the maximally entangled state 
to Bob, she can know all of Bob's outcomes from the 
perfect correlations of the maximally entangled states. 
Then, she announces all of Bob's outcome to him. Bob 
compares them with his data. If all of them coincide with 
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his ones, Bob make sure that Alice has not cheated. 

5) The final bit value ( the outcome of coin tossing ) 
is determined as the parity bit of all of Bob's outcomes. 

If Alice honestly sent to Bob the maximally entangled 
states, there will be no problem: each outcome of N spin- 
measurement is random and consequently the parity bit 
of Bob's outcomes is also random. If Alice try to cheat 
by sending non-maximally entangled states, she cannot 
correctly predict all of Bob's outcomes. Thus, she can- 
not pass the test of step4. On the other hand, Bob has 
no way of cheating if Alice honestly follows the protocol 
because he only receives the quantum states. Therefore, 
both parties can be sure that they have not been cheated. 
To be more precise, let us show that the proposed proto- 
col satisfy the four requirements for ideal quantum coin 
tossing presented in Ref. . 

a) At the end of the coin tossing scheme, there are 
three possible outcomes: '0', '1' or 'invàlid'. 

b) Both users know which outcome occurs. 

c) If the outcome '0' or '1' occur, Alice and Bob can be 
sure that they occur with prescribed probabilities, say ^ 
each. 

d) If both users are honest, the outcome 'invàlid' will 
never occur. 

As we have shown, if Alice try to cheat by sending non- 
maximally entangled states to Bob, she cannot pass the 
test of step4. In this case, the outcome 'invàlid' occurs ( 
including the following 'honest' case, (a) is satisfied ). If 
Alice honestly sent maximally entangled states to Bob, 
then Alice can know all of Bob's outcomes with certainty. 
Hence, both users know the final outcome defined as the 
parity bit of all of Bob's outcomes ( (b) is satisfied ). 
Since spin-measurement on a particle of the maximally 
entangled state give random outcome with probabilities 
^, the final outcome occurs with probabilities ^, too ( (c) 
is satisfied ). If Alice is honest, the outcome 'invàlid' will 
not occur in this protocol given that there is no noise ( 
(d) is satisfied ) . 

In the Ref. |Ï4| , it was shown that quantum coin toss- 
ing is impossible without entangled states shared by Alice 
and Bob. From this fact it was concluded that quantum 
coin tossing is impossible. For authors, it is not clear 
why entangled states are not to be used in quantum coin 
tossing. In our scheme the maximally entangled states 
are used indeed. 

Quantum coin tossing, by itself, may not be an impor- 
tant application of QC. Even QBC is thought as a means 
to an end- two party secure computation. On the other 
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hand, in Ref. || , it was conjectured that the impossibil- 
ity of QBC is due to the asymmetry it creates and that 
only asymmetrical tasks are impossible. In this Report, 
we have shown that a quantum coin tossing protocol ( 
which is a symmetric work ) exists, supporting the con- 
jecturo . Thus, it could be that although asymmetrical 
( one-sided ) two-party computation is impossible p3[ , 
symmetrical ( two-sided ) two-party computation is still 
possible. This problem should be further investigated. 
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